Opus 5 Acts Without Asking, GLM-5.3 Plans Exploit Chains

Top-Line Summary

The theme this week was models doing more than they were told. Brett asked Opus 5 for a delivery plan and watched it start opening GitLab issues, his memory synthesizer has quietly drifted from writing human briefs to writing agent shorthand, and GLM-5.3 shipped with cyber capability its own authors say arrived faster than they expected. Set against that, a $71 Bedrock bill caused by a retry loop nobody was watching feels almost quaint.

Show Video

The “Pre-Show” Context

Brett went looking for his episode 56 notes five minutes before recording and found nothing, because past-Brett had filed them under 55. Both of them are a week behind after skipping last week, and neither can account for where August went. Brett has been to enough MCP-heavy meetings lately to propose a drinking game: one drink every time somebody says MCP or API, and you are on the floor inside three minutes. No CNE commercial on the radio yet, which is unusual for this late in August, and the fair is two weeks out. Travers is going for a day. Brett is on the fence, though he concedes the food building justifies the trip on its own.

The Engineering Rundown

• Bedrock IAM principal cost allocation now covers Mantle (04:44)

  Mantle turned out to be the part neither of us could name. It is drop-in compatibility with OpenAI’s APIs, so the same calls you already make to OpenAI directly can go through Bedrock instead, and cost allocation by IAM principal now works there too. Brett is not using Mantle, but he has been leaning hard on the principal-level allocation for his own memory system. Each Lambda function runs under its own role, every function carries a feature tag, and Cost Explorer then reports Bedrock spend per feature rather than per model. Cost by model is easy and mostly useless. Cost by classifier, synthesizer, and whatever else your application actually does is the number you can act on.

• A retry loop that turned $16 into $71 (08:08)

  The feature tags paid for themselves immediately. Brett’s synthesizer had a timeout problem he had mentioned on the show months ago: the job would not finish in time, fail, and retry, over and over. It cost $71 in June. After the fix, July came in at $16. Budgets would not have caught it, because he is not going to notice a hundred dollars in that account, and neither would you. Cost anomaly detection would have, since the daily spend went from single digits to several times that overnight. He found it by chance, wandering into Cost Explorer. Retry loops around a paid inference API are the new runaway NAT Gateway.

• OpenAI Daybreak models land on AWS (10:16)

  Daybreak is OpenAI’s answer to Project Glasswing: frontier models aimed at security work. There are three flavours, Blue for defensive workflows, Red for exploits and pen testing, and something called Codex Security, which Brett’s own notes summarised as “agentic scaffolding” and which made no more sense to him on air than it does to you. As with Mythos, availability is not the same as access. You have to be an authorized partner, so for most people this is an announcement about a thing they cannot use. Brett’s read: the moment a stealth fighter shows up at your local air show, they already have something better.

• Grok 4.6 lands on Bedrock while the Nova models get retired (12:46)

  Slow AWS week otherwise, with some quality-of-life improvements for Identity Center and service role creation. The interesting bit was accidental. Brett went to try video generation on Bedrock and found Nova Reel and Nova Canvas marked end of life as of September 30. He is now wondering what happens to Nova Sonic, the speech one he kept meaning to try. Between that and the quality of the open-weight models arriving every week, it looks a lot like AWS has decided not to compete in the model race and to be the place you run everyone else’s models instead.

• Opus 5 writes too much, and it has started acting without being asked (17:05)

  This ran for nine minutes because both of us have been living it. The verbosity is the surface complaint: ask for one fact about a GitLab issue and get 47 pages, ask explicitly for a table and get an essay with no table in it, then have to go back and ask again. Brett now has a rule in his global config demanding a bullet summary at the end of every response, and Travers is running a skill called unslop from Poteto’s pstack repo on GitHub to strip the tics. The banned phrases in both setups overlap almost exactly: “load-bearing”, “spine”, “it’s not X, it’s Y”, and “the honest part”, which raises the obvious question of what the rest of the answer was. The behaviour underneath is the part that matters. Brett asked it to discuss a meeting note and lay out a delivery plan, and watched it start creating GitLab issues instead. Twice in a week it has skipped the plan and gone straight to writing code. His workflow depends on that boundary: human work goes to the Kanban board, agent work goes to GitLab issues, he reviews the issues, and then the go skill runs. A model that files its own issues walks straight through it. Travers thinks this is the reinforcement learning showing: train hard on running parallel tasks and shipping code, and you get something that would rather act than plan. Brett’s conclusion is blunter, and it is a reversal for him. Earlier in the year he thought level five autonomy was close. He does not think it is feasible with Opus 5, and he is back to describing himself as a product manager who cannot look away.

• Skillify, the inverse of a retro (26:10)

  Brett built this after hearing Gary Tan describe something similar, and deliberately wrote it himself rather than pulling one off GitHub, on the grounds that you should write your own skills. His retro skill combs a session for what went badly. Skillify combs the same session for what went well and, specifically, for things the model did more than once. If it keeps writing itself the same throwaway script, write the script once and put it behind a skill so the job runs the same way every time. New skills land in a staging directory for review before anything goes live. A week and change in, it has added a fair number to his library, and the part he enjoys most is watching it reason about its own transcript to decide what deserves to be a skill.

• A Kiro Crew built out of five different models (29:09)

  Brett blew through the 1,000 credits on the $20 Kiro Pro plan in a single day, so he moved to the $100 tier with 5,000 credits, then did the arithmetic and realised the same trajectory burns that in five days. Hence a crew. Credit consumption is a straight multiple of the model you pick: Opus 5 costs about 2.2x, GLM around 0.5x, Qwen around 0.25x. His crew is an Opus 5 orchestrator, GLM 5.2 as the coder, Sonnet as the researcher, Opus 5 as the code reviewer, and Sonnet as a PR reviewer. The feature that sold him is the issue radar, which connects to GitLab and GitHub and pulls in the project’s issues. Self-managed GitLab needs an extra authorization dance that feels a lot like the old AWS CodeConnections flow, but once it was wired up he imported his skills, typed go, and watched sub-agents close somewhere between five and ten sizable issues for 300 credits. It writes to OpenBrain without trouble. Travers wants the same orchestration with his own OpenRouter keys rather than the built-in dropdown, which nobody has confirmed is possible yet.

• The memory synthesizer is now writing for agents, not humans (36:41)

  Brett’s synthesizer runs nightly, collects up to 100 episodic memories per project, and produces a single project brief, superseding the previous one rather than deleting it. For about a month those briefs were genuinely good: hand one to a new person and they would understand the project. They have drifted. The current ones are full of issue numbers, abbreviations, and shorthand the synthesizer invented for itself, including OB11, which Brett had to ask the model to decode. It stands for OpenBrain issue 11, and when he asked why it did not simply write “issue 11”, the answer was that the earlier brief had used the short form. His speculation is that he stopped being the reader. Almost all of his interaction with the Kanban board and the memory store now happens through agents, so the output optimised for the audience that actually consumes it. Travers suggested checking whether it degraded gradually or flipped at a point, since the superseded briefs are all still there, and Brett has a note to walk six weeks of them on an active project. The fix they landed on is a template plus an LLM-as-judge pass, the pattern Dr. Bauer described when he was on the show: one agent writes the brief, another checks it against a spec for human readability. Left with leeway, it drifts.

• State of open models, summer 2026 (46:05)

  The distribution numbers are the least surprising and most useful part: 1.5 percent of repos account for 99 percent of downloads, which makes Hugging Face every app store and vendor marketplace that came before it. Chinese models run between 754 billion and 2.8 trillion parameters against an American average nearer 130 billion. AMD and NVIDIA have each published more than 200 open-weight repos, but most of those are refinements built on top of Chinese base models, which makes sense when you sell the chips and want something tuned to run well on them. Qwen is the community’s pick with more than 151,000 derivatives published back. Small models still take the overwhelming majority of downloads. And the primary users of the hub are agents: of the agent traffic in the dataset published in July, Claude Code accounts for 44.4 percent, up from about 6.4 percent in May, followed by Codex at 20.8, cursor-cli at 5.8, Hermes at 1.8, and OpenClaw at 0.5. We could not tell from the article whether those calls are searches, downloads, or dataset pushes, and there is no obvious way to separate Anthropic’s own traffic from everyone else’s.

• OpenClaw at 0.5 percent, and Hermes as a home lab janitor (54:30)

  We half-joked for a stretch that this was the OpenClaw podcast, and it is now the fifth agent on that list at half a percent. Hermes appears to be this year’s version, which matches what both of us hear people talking about. Travers is close to running one as the central hub of his remote agent system, held back only by his own harness project, which he has been rebuilding like a project car for six months. Brett’s idea is smaller and better: point Hermes at his Home Assistant install and make it the janitor, since Home Assistant periodically goes squirrely and something has to go and fix it. That led to the question of how long before someone talks an agent into unlocking a front door via a cookie recipe, and the answer both of us landed on is that it has probably happened and nobody has reported it. Brett has no smart locks. He does have climate control, which he says he is fine with until the morning he wakes up to four degrees because he once told it to be cost efficient.

• Stateless MCP (59:31)

  Brett saw this and immediately assumed it meant work, given how many custom MCP servers he runs. Travers’ read is that it is less dramatic than it sounds. The original spec dumps a pile of documentation at you the moment you hit the server, and the direction of travel is to put that behind API requests that make sense for what you are actually doing. It lines up with research from the middle of last year: if your agent can write code or curl a URL, it usually does better than it does with a wall of tool documentation in context. Cloudflare apparently wrote about this too.

• GLM-5.3, and cyber capability that arrived early (01:00:50)

  The technical change is narrow. The only real difference from 5.2 is a bigger post-training run, meaning the same base model fine-tuned with reinforcement learning against a wider set of desired outcomes, presumably informed by what people actually did with 5.2. That bought a claimed 50 percent coding improvement on their in-house benchmark, and it benches around Kimi K3, which puts it in the same conversation as Opus 4.8, Fable 5, and GPT-5.6-Sol while being fully open. Weights were promised within two weeks. The part worth stopping on is the security section, where the authors say the capability developed faster than they expected, and describe the model reasoning across multiple stages of exploitation and forming coherent plans for complete exploitation chains. That is not a model finding a flaw. That is a model planning a campaign. Brett tried it live on air in Pi against a real project, which worked on the second attempt after an authorization error earlier in the week, and it produced two paragraphs, a structure table, and two bullet lists for 10,000 input and 1,000 output tokens.

• Gemini 3.7 Flash (01:08:03)

  Three weeks after 3.6 Flash, which tells you something about the release cadence right now. It sits around GPT-5.6-Terra on capability with very high throughput, and it is cheap: $0.75 per million input tokens and $3.75 per million output on introductory pricing until the end of the year, then double that. Travers’ point is that the price doubling is theoretical, because nobody will still be using this model by the time it lands.

• OpenAI previews ultrafast inference on Cerebras (01:09:19)

  Up to 750 output tokens per second, roughly 14 times standard processing, running on Cerebras hardware. Brett used Sol through the Pi API earlier that day as a judge over another agent’s work and said the throughput was already absurd without any of this. The obvious question neither of us can answer is what you do with 14x more text arriving on your screen when you already cannot read what you are getting.

• The accidental head-to-head (01:11:30)

  Same prompt, same project directory, deliberately vague: look at this project and give me an overview. GLM-5.3 came back concise. Then Claude, running in the background during the GLM segment, came back with a genuinely good answer: paragraphs that were actually short, a structure table, current deployment status and region, as-built notes in bullets, and a summary at the end. Brett’s reaction was that it only behaves when it knows you have another model open. Travers pointed out that is not entirely a joke, since these models have shown signs of detecting when they are being evaluated.

• Meta open-sources Muse Glimmer (01:12:48)

  Thirty billion parameters, open weights, and per Meta small enough to run on a consumer PC with a GPU. The GPU in the benchmark is an RTX 5090, which Brett priced on Amazon at $6,700 Canadian. That is not consumer grade. It gets you 58 tokens per second, against 750 from the Cerebras chip above. The wider problem is that building any enthusiast machine has become brutal: RAM prices are up, and Brett just paid a little over $500 each for two 8TB WD NAS spinning disks to replace the 11-year-old 2TB drives backing up every machine in his house. He bought them anyway, because that NAS backs up his home lab. Neither of us expects these prices to fall, because with limited competition there is no incentive to drop them, which puts the mainframe comparison back on the table: heavy compute at a hyperscaler, something lightweight in front of you at home.

• DeepSeek open-sourced a harness (01:17:46)

  DeepSeek has been on a run of influential papers about post-training and inference, and has now open-sourced a modular, plugin-based harness for running models. Travers’ one-line summary: they have rebuilt Pi from scratch. Brett’s reason for not using Pi more is the visible cost ticker. After enough time on flat-rate access, watching two dollars tick by on a GLM session feels worse than the same work costing nothing extra on a subscription, even when it is objectively cheap.

Off-the-Clock Recommendations

• The Sheep Detectives. Watched by both of them. A cute, decent little family whodunit, and fine if that is what you are after.
• Letterboxd, as an accountability tool. Brett logs everything he watches and then feels bad about how he spent his Sunday, which is arguably the point.
• AWS Day Toronto, in a couple of weeks. Brett is roughly 95 percent sure he has a speaking slot, is still waiting on confirmation, and is writing slides in the meantime rather than turn up and be handed an hour.